crowdsecurity/crowdsec · error

unable to decode response: %w

Error message

unable to decode response: %w

What it means

Returned by refreshJwtToken when the successful (2xx) login response body is not valid JSON or does not match the WatcherAuthResponse shape, so the returned token cannot be extracted. Wraps the json.Decoder error while reading the response body.

Source

Thrown at pkg/apiclient/auth_jwt.go:131

		dump, _ := httputil.DumpResponse(resp, true)
		log.Tracef("auth-jwt response: %s", string(dump))
	}

	defer resp.Body.Close()

	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
		log.Debugf("received response status %q when fetching %v", resp.Status, req.URL)

		err = CheckResponse(resp)
		if err != nil {
			return err
		}
	}

	var response models.WatcherAuthResponse

	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
		return fmt.Errorf("unable to decode response: %w", err)
	}

	if err := t.Expiration.UnmarshalText([]byte(response.Expire)); err != nil {
		return fmt.Errorf("unable to parse jwt expiration: %w", err)
	}

	t.Token = response.Token

	if t.TokenSave != nil {
		err = t.TokenSave(ctx, t.Token)
		if err != nil {
			log.Errorf("unable to save token: %s", err)
		}
	}

	log.Debugf("token %s will expire on %s", t.Token, t.Expiration.String())

	select {

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the endpoint is a crowdsec LAPI (no proxy/error page in between)
2. Check LAPI version compatibility
3. Inspect LAPI logs for the corresponding login request

When it happens

Trigger: Thrown at pkg/apiclient/auth_jwt.go:131 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/fb188e408c317691. Report an issue: GitHub.